1

I have a Raspberry Pi that I am using to store my private files in a cloud (like dropbox)

I used this whole tutorial for configuring the Pi https://www.pestmeester.nl/

the Ip tables were configured according to the tutorial:

*filter 
#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allows SMTP access
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT

# Allows pop and pops connections
# -A INPUT -p tcp --dport 110 -j ACCEPT
# -A INPUT -p tcp --dport 995 -j ACCEPT

# Allows imap and imaps connections
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT

#  Allow SSH connections
#  The -dport number should be the same port number you set in     sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

Iptables -L shows Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh ACCEPT all -- anywhere anywhere REJECT all -- anywhere loopback/8 reject-with icmp-port-unreachable ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:urd ACCEPT tcp -- anywhere anywhere tcp dpt:submission ACCEPT tcp -- anywhere anywhere tcp dpt:imap2 ACCEPT tcp -- anywhere anywhere tcp dpt:imaps ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT icmp -- anywhere anywhere icmp echo-request LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: " DROP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

and iptables-save

# Generated by iptables-save v1.4.21 on Fri Jun 30 12:43:24 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: "                     --log-level 7
-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT
-A fail2ban-ssh -j RETURN
COMMIT

now to my problem: in the syslog I have lots of entries like that: Jun 30 12:00:46 raspberrypi kernel: [6978137.058941] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:c8:1f:66:21:0d:62:08:00:45:00:01:9b:16:66:00:00:80:11:af:dc SRC=192.168.178.103 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=5734 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:10 raspberrypi kernel: [6978160.864968] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:47:8b:00:00:80:11:7f:06 SRC=192.168.178.24 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=18315 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:10 raspberrypi kernel: [6978160.865463] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:6f:9b:00:00:80:11:e3:4d SRC=192.168.178.24 DST=192.168.178.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=28571 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:40 raspberrypi kernel: [6978190.866330] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:47:8c:00:00:80:11:7f:05 SRC=192.168.178.24 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=18316 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:40 raspberrypi kernel: [6978190.866884] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:6f:ae:00:00:80:11:e3:3a SRC=192.168.178.24 DST=192.168.178.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=28590 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:01:46 raspberrypi kernel: [6978197.138692] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:c8:1f:66:21:0d:62:08:00:45:00:01:9b:16:6e:00:00:80:11:af:d4 SRC=192.168.178.103 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=5742 PROTO=UDP SPT=17500 DPT=17500 LEN=391 Jun 30 12:02:10 raspberrypi kernel: [6978220.883154] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:99:b5:ec:e0:08:00:45:00:01:9b:47:8d:00:00:80:11:7f:04 SRC=192.168.178.24 DST=255.255.255.255 LEN=411 TOS=0x00 PREC=0x00 TTL=128 ID=18317 PROTO=UDP SPT=17500 DPT=17500 LEN=391

from time to time the pi looses its connection and the only thing that restores the connection is service supervisor restart could those 2 problems be connected to each other? What could I do to configure the ip tables correctly? With the log with these many entries I am not really able to detect the problem that the owncloud has.

I really hope someone will be able to help me

Improve this question

1 Answer 1

Reset to default
1

You can deny the Dropbox broadcasts on your Raspi. The 17500 port is used by Dropbox on an other machine.

So add before the LOG rule : -A INPUT -p udp --dport 17500 -j DROP

Then the raspi will drop the connection without logging them.

Improve this answer
4
  • ohhh thank you very much! I would have never thought of the dropbox ... but probably the two problems are not connected. Do you maybe have an idea how i could adress the loss of connectivity that appears from time to time? Its really bad if i am on holidays and have to access my files that are saved on the owncloud in the office
    – user9821
    Jun 30, 2017 at 11:02
  • No, I am sorry, you don't provide enough info. You must check the logs when the Pi loose its connection.
    – Dom
    Jun 30, 2017 at 12:08
  • Ok i will have a look at the logs next time i am at my office. The problem is that I am not able to restart the connection without beeing at the office PC and putting service supervisor restart into a cronjob doesnt seem to help. Do you know a way, that I can restart the service by using the cronjob? Restarting the service each 20 Minutes doesnt help when the connection is lost, but entering the command manually does
    – user9821
    Jun 30, 2017 at 12:38
  • I think there is something more important hide in your problem. You need to wait and check the logs. Maybe out of memory, maybe something else, but you will see in the logs. When you restart the service by cron, do you have errors ?
    – Dom
    Jun 30, 2017 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .